Best Risk Strategy for an Unpatchable Critical Legacy System?
Short answer
B Use compensating controls like segmentation, WAF/IPS, access restrictions, and monitoring to reduce legacy-system risk without downtime or patches.
Question
• No downtime is permitted due to criticality.
• Patches for the vulnerabilities do not exist.
• No redundancy systems are in place.
Which of the following is the best risk management strategy to implement?
Key Takeaways
The exam tests whether you can separate mitigation via compensating controls from acceptance when a patch is unavailable; the trap is concluding that an unpatchable flaw can only be accepted.
This scenario tests risk response selection when a critical legacy system cannot be patched, taken down, or failed over. The page establishes that mitigation through compensating controls is the best strategy, not acceptance or transference.
Common mistake: Choosing acceptance (D) because no patch exists, ignoring that segmentation, WAF/IPS filtering, access restrictions, and monitoring can still reduce risk.
Expert Analysis
Why the Answer Is Correct
Mitigation is the best fit for all three constraints because it reduces risk without requiring a patch, downtime, or redundant systems. Compensating controls such as network segmentation, WAF/IPS filtering, tighter access restrictions, and enhanced monitoring can lower the likelihood or impact of exploitation on the legacy system. The critical system can remain online while its exposure is reduced to a more acceptable residual level. This is the core risk-management distinction the question is testing: an unpatchable vulnerability does not automatically mean the only response is acceptance.
Why the Other Options Are Wrong
Transference shifts financial or contractual consequences, for example through cyber insurance or outsourcing, but it does not remove the vulnerability from the critical legacy system. Avoidance would mean stopping the business activity or decommissioning the system, which conflicts with the no-downtime and criticality constraints. Acceptance means formally living with the risk without applying further controls, which is premature when feasible compensating controls exist. Acceptance may describe the residual risk after mitigation, but it is not the best primary strategy here.
Community Comment Notes
rocco82 supports mitigation and points to firewalls, segmentation, and WAF as practical controls. rvln7 makes the strongest case for B, noting that "the risk can still be reduced through compensating controls" even without a patch, and correctly warns that treating acceptance as doing nothing is too passive when technical controls exist. Pochex argues for acceptance because the vulnerability remains, but that reasoning confuses residual risk with the absence of mitigation; insurance or outsourcing would still leave the flaw in place. The community split reflects the intended trap: the vulnerability cannot be eliminated, but it can still be mitigated.
Official Reference
These links open the official vendor documentation in a new tab.
Exam Strategy
When a question blocks patching or downtime, look for answers that still reduce likelihood or impact; compensating controls point to mitigation. Do not default to acceptance unless every feasible control is exhausted and the risk is formally approved.
Frequently Asked Questions
Why isn't acceptance the right answer for an unpatchable legacy system?
Can cyber insurance or outsourcing replace mitigation for this legacy system?
Discussion 5 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 5
-
rvln7 👍 1Even without a patch, the risk can still be reduced through compensating controls (network segmentation, WAF/IPS, access restrictions, enhanced monitoring), and that's MITIGATION. Acceptance means doing nothing, but here feasible technical controls exist within the constraints, so the answer is B, not D.
-
Pochex 👍 1 Answered DAcceptance is the only option since the risk cannot be eliminated or reduced through technical controls, the organization must live with the risk as-is, even if you transfer it to a third party (e.g., insurance, outsourcing), the vulnerability remains.
-
agfencer 👍 1 Answered BMitigation, surely its the best option when the other option is acceptance. There have to be some mitigation solutions available such as network segmentation, monitoring etc.
-
tailogdavid1987 👍 1 Answered DNo patches exist, no downtime is allowed, and no redundancy is available. The only remaining risk-management strategy is formal acceptance of the residual risk
-
rocco82 👍 1 Answered BLots of mitigation possible, firewalls, segmentation and waf
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.